• Definition of cybersecurity risk: risk = threat × vulnerability × impact
• The role of risk management in overall business strategy
• Common risk frameworks (NIST CSF, ISO 27005, FAIR)
• Risk appetite, tolerance, and residual risk

• Identifying assets: data, hardware, software, people, reputation
• Classifying assets by criticality and confidentiality
• Business Impact Analysis (BIA) – understanding the cost of loss
• Mapping assets to business processes and revenue streams

• Sources of threats: external adversaries, insiders, nation-states
• Vulnerability discovery – scanning, penetration testing, audits
• Common Vulnerability Scoring System (CVSS) and its use
• Environmental vs. inherent vulnerability scoring
• Threat intelligence integration into risk analysis

• Qualitative analysis: scenario-based, high/medium/low ratings
• Quantitative analysis: ALE (Annualized Loss Expectancy), SLE, ARO
• Risk matrices and heat maps
• Selecting the appropriate methodology for the environment

• Four treatment options: avoid, mitigate, transfer, accept
• Implementing controls (administrative, technical, physical)
• Cost-benefit analysis and return on security investment
• Residual risk monitoring and continuous improvement

• Creating and maintaining a risk register
• Reporting risk to leadership and stakeholders
• Integrating risk assessments into the incident response plan
• Alignment with NIST 800-61r2 and NCIRP guidelines

Think of them like characters in a video game:

• Hacktivists — protestors who hack to make a point (like Robin Hood, but with computers)
• Cybercriminals — thieves who want money (they steal credit cards or hold data for ransom)
• Nation-states — spies working for countries (like secret agents, but they steal secrets)
• Insiders — people who work inside the castle but turn against it (maybe they're angry or greedy)
• Script kiddies — beginners who use tools made by others (like using a cheat code without knowing how it works)

Every villain has a reason. Here's why cyber bad guys do what they do:

• 💰 Money — steal credit cards, sell data, or demand ransom
• 🤫 Secrets — steal company plans, military secrets, or personal info
• 😡 Revenge — angry employees or former workers who want to hurt the company
• 🎮 Fun or fame — some just want to show off their skills
• 🌍 Political reasons — to make a statement or hurt a country

It's like having a spyglass to see what the bad guys are doing from far away.

• Open Source Intelligence (OSINT) — looking at public info (like social media or news) to learn about threats
• Threat Feeds — special lists that tell us about new attacks happening right now
• Honeypots — fake computers that look real, to trick attackers into revealing themselves
• Sharing with friends — companies share info about attacks so everyone can be prepared

These are the tools bad guys use to break in:

• 🦠 Malware — nasty software that does bad things (viruses, worms, trojans)
• 🎣 Phishing — fake emails that trick you into giving away passwords
• 🔑 Password attacks — guessing or stealing your password
• 🚪 Backdoors — hidden ways into a system that the bad guys create
• 💥 Denial of Service (DoS) — flooding a website with so much traffic that it crashes
• 🔄 Man-in-the-Middle — eavesdropping on a conversation and stealing info

The bad guys are getting smarter. Here's what's new:

• 🤖 AI-powered attacks — using artificial intelligence to create smarter viruses
• ☁️ Cloud attacks — targeting the "cloud" where many companies store their data
• 📱 Mobile attacks — attacking phones and tablets
• 🔗 Supply chain attacks — attacking one company to get into another (like putting poison in the food delivery truck)
• 💰 Ransomware gangs — organized groups that attack big companies for huge ransoms

Every good hero needs armor. Here's how we protect ourselves:

• 🧠 Awareness — knowing what attacks look like so you don't fall for them
• 🔄 Updates — keeping software up-to-date like getting new armor
• 🔐 Strong passwords — using hard-to-guess passwords (like "PurpleDragon2024!" not "password123")
• 📚 Training — teaching everyone in the company how to spot danger
• 🧪 Testing — running fake attacks to see if your defenses work

Reconnaissance = Spying before attacking.

Bad guys gather information about their target to find the easiest way in.

• Passive Recon: Like listening to a conversation without being seen. The attacker doesn't touch your systems — they just watch.
• Active Recon: Like knocking on the door to see if someone's home. The attacker interacts with your systems, which might leave clues.

The attacker gathers information from public sources. It's like reading a book about someone instead of asking them directly.

• Google searches — finding employee names, emails, or company info
• Social media — learning about people, their interests, and their job roles
• Job postings — seeing what technology the company uses (they often list it in job ads!)
• Shodan — a search engine for internet-connected devices (like a "Google for computers")
• WHOIS lookups — finding out who owns a website

The attacker sends probes to your systems to see what's there. This is riskier for them because they might get caught.

• Network scanning — using tools like Nmap to see which computers are on the network
• Port scanning — checking which "doors" (ports) are open on a computer
• Vulnerability scanning — using tools like Nessus to find weaknesses
• Ping sweeps — sending a "ping" to see if a computer responds
• Banner grabbing — asking a computer to "introduce itself" to learn what software it runs

Sometimes the easiest way to get information is to just ask for it. Social engineering is when attackers trick people into giving away secrets.

• Phishing emails — fake emails that look real, asking for passwords or personal info
• Vishing (voice phishing) — phone calls where someone pretends to be from IT or the bank
• Smishing (SMS phishing) — fake text messages with links to bad websites
• Pretexting — making up a story to get information (like "Hi, I'm from IT, I need your password to fix an issue")
• Tailgating — following someone into a secure building without having a keycard

Here are some of the tools attackers use for reconnaissance (and defenders use to test their own systems).

• 🔍 Nmap — the "Swiss Army knife" for network scanning. It finds computers and open ports.
• 🕸️ Shodan — the search engine for internet-connected devices. You can find anything from webcams to industrial controls!
• 🔬 Wireshark — a tool that "sniffs" network traffic to see what data is being sent.
• 📧 Maltego — a tool that connects information from different sources to build a picture of an organization.
• 🌐 TheHarvester — a tool that gathers email addresses and domain information from public sources.

Just like you'd close your curtains and lock your doors, you can protect your organization from being "cased."

• 🧑‍💻 Employee training — teach people to spot phishing and social engineering
• 🔒 Hide public information — don't share too much on social media or job postings
• 🛑 Network security — use firewalls to hide open ports from scanners
• 📡 Detection systems — use tools that can spot scanning activity (like an intrusion detection system)
• 🧪 Regular testing — do your own reconnaissance (with permission!) to see what an attacker could find
• 🔐 Strong authentication — use multi-factor authentication so even if someone gets a password, they can't get in

Malware = Malicious Software. It's like a sickness for computers.

Attackers don't just attack computers — they also attack websites and web applications.

• SQL Injection: Tricking a website into giving up its database secrets by entering special code in a form
• Cross-Site Scripting (XSS): Hiding bad code in a website that runs when someone visits it
• Cross-Site Request Forgery (CSRF): Tricking your browser into doing something you didn't mean to do (like changing your password)
• Session Hijacking: Stealing your "session cookie" so attackers can pretend to be you
• Clickjacking: Hiding a button underneath another button — you think you're clicking one thing, but you're actually doing something else

These attacks target the network — the "roads" that computers use to talk to each other.

• DDoS (Distributed Denial of Service): A huge flood of traffic that crashes a website (like millions of people trying to enter a tiny door)
• Man-in-the-Middle (MITM): The attacker secretly listens to a conversation between two computers, like eavesdropping on a phone call
• Packet Sniffing: Using a tool to capture and read data as it travels across the network
• ARP Spoofing: Tricking computers into sending their data to the attacker instead of the right place
• DNS Spoofing: Pointing a website's address to a fake website (like a fake bank website)

Sometimes attackers don't just steal data — they take over entire accounts or systems.

• Account Hijacking: Stealing someone's username and password to take over their account
• Session Hijacking: Stealing a user's "session" while they're logged in
• Identity Theft: Pretending to be someone else by using their stolen information
• Website Defacement: Changing the content of a website to show something embarrassing or offensive
• DNS Hijacking: Taking control of a website's address to send people to a different place

As more people use phones and store data in the cloud, attackers are going after these too.

• Cloud Misconfiguration: Leaving cloud storage open to the public by mistake (like leaving your diary open on a park bench)
• Cloud Account Takeover: Stealing cloud account credentials
• Mobile Malware: Bad apps that steal data from your phone
• Jailbreaking/Rooting: Removing security protections from a phone to install bad software
• App Spoofing: Fake apps that look like the real thing but steal your info
• SIM Swapping: Tricking your phone carrier into giving your phone number to the attacker

Every attack has a defense. Here's how we fight back:

• 🔄 Keep software updated — fixes holes that attackers use
• 🔐 Use strong, unique passwords — don't use "password123" everywhere!
• 📱 Use multi-factor authentication (MFA) — a second lock on your door
• 🔥 Firewalls — block unwanted network traffic
• 🦠 Antivirus & Endpoint Protection — stop malware before it runs
• 📋 Backups — if ransomware locks your files, you can restore them
• 🧠 Training — teach everyone to spot attacks

Attackers follow a path after they first get in. It's like a game with multiple levels.

● Entry  |  ● Post-attack  |  ● Deep inside

C2 is how attackers talk to hacked computers. It's like a remote control for a robot.

• Beaconing: The hacked computer "calls home" regularly to check for instructions
• DNS Tunneling: Hiding commands in normal-looking internet address requests
• HTTP/S Tunneling: Hiding commands in web traffic (like hiding a secret message in a normal email)
• ICMP Tunneling: Using "ping" messages to send commands
• Peer-to-Peer C2: Computers talk to each other instead of a central server (harder to stop!)

Attackers want to stay inside even if the computer restarts or security tries to remove them.

• Registry Keys (Windows): Setting up a program to run automatically when Windows starts
• Cron Jobs (Linux): Scheduling a malicious program to run regularly
• Scheduled Tasks: Creating automatic tasks that run at specific times
• Startup Folders: Placing a program in a folder that runs when you log in
• Services: Creating a fake "service" that looks important but is actually malicious
• Backdoor Accounts: Creating a secret user account they can use to log in later

Attackers don't just stay in one computer — they spread to others in the network to find more valuable data.

• Pass-the-Hash: Stealing a password "hash" and using it to log in to other computers without the real password
• Pass-the-Ticket (Kerberos): Stealing authentication tickets to impersonate a user
• RDP Exploitation: Using Remote Desktop to jump between computers
• SSH Keys: Stealing secure shell keys to access other servers
• Pivoting: Using one hacked computer as a "jump box" to attack others that are harder to reach
• BloodHound / SharpHound: Tools attackers use to map out the network and find the easiest path to the most valuable computers

This is the attacker's final goal — to take valuable data out of the company.

• Data Staging: Collecting stolen data in one place before sending it out
• Compression: Squeezing data into a zip file to make it smaller and faster to steal
• Encryption: Locking the stolen data so nobody can read it if caught
• Cloud Storage: Uploading stolen data to Dropbox, Google Drive, or other cloud services
• Email: Emailing stolen data to themselves in small pieces
• DNS Exfiltration: Hiding stolen data in internet address requests (slow but stealthy)
• Steganography: Hiding stolen data inside pictures or videos (like invisible ink!)

After the attack, bad guys try to erase evidence so nobody knows they were there.

• Deleting Logs: Removing or changing system logs that show what happened
• Clearing Event Logs (Windows): Deleting the "history" of events on a Windows computer
• Deleting Command History (Linux): Removing the list of commands they typed
• Shredding Files: Overwriting files so they can't be recovered (like shredding paper)
• Disabling Audit Logs: Turning off security logging before the attack even starts
• Timestamp Manipulation: Changing file dates and times to confuse investigators
• Rootkits: Special malware that hides deep in the system and is very hard to detect

Security posture is how strong or weak an organization's defenses are.

It's like a health check-up for your security systems.

A good posture means: ✅ Updated software, ✅ Strong passwords, ✅ Trained employees, ✅ Monitored networks

An audit is a formal inspection to check if security rules are being followed.

• What auditors check: Passwords, access controls, software updates, backups, training records
• Internal audits: Done by the company's own team (like checking your own homework)
• External audits: Done by outside experts (like having a teacher check your work)
• Compliance audits: Checking if the company follows rules like GDPR or HIPAA
• Audit evidence: Logs, policies, interviews, and system scans

Vulnerability management is the process of finding, fixing, and preventing weaknesses.

• Vulnerability scanning: Using tools to automatically find weaknesses (like scanning a castle wall for cracks)
• Common Vulnerabilities and Exposures (CVE): A public list of known weaknesses (like a "wanted poster" for bugs)
• CVSS Scoring: Rating vulnerabilities from 0-10 based on how dangerous they are
• Patch management: Applying "fixes" (patches) to software to close holes
• Vulnerability lifecycle: Discover → Report → Fix → Verify → Close

Penetration testing (or "pen testing") is when cybersecurity experts try to break into their own systems on purpose.

• White box testing: The testers have full information (like having a map of the castle)
• Black box testing: The testers have no information (like a stranger trying to break in)
• Gray box testing: The testers have some information (like knowing where the castle is but not the secret passages)
• External testing: Trying to break in from outside the network
• Internal testing: Testing what an attacker could do if they were already inside

Threat intelligence is information about attackers, their methods, and what they're targeting.

• Open Source Intelligence (OSINT): Public information like news, social media, and forums
• Closed source intelligence: Information from security companies and government agencies
• Technical intelligence: Technical details about attacks (like what software they're using)
• Strategic intelligence: Big-picture information about who's attacking and why
• Threat feeds: Real-time lists of current threats and attacks

Once you find problems, you need to fix them. Here's how:

• Risk prioritization: Fix the most dangerous problems first (like patching a hole in the wall before painting the bathroom)
• Risk treatment options:
  • ✅ Mitigate: Fix the problem
  • 🚫 Avoid: Stop doing the risky activity
  • 📋 Transfer: Buy insurance or outsource the risk
  • 😐 Accept: Decide the risk is small enough to ignore
• Continuous improvement: Security isn't a one-time thing — you have to keep checking and improving
• Security awareness training: Teach everyone in the organization how to stay safe

Cybersecurity intelligence is information that helps us understand and stop cyber attacks.

It's like having a spy network that tells you what the bad guys are planning.

• Why we collect it: To detect attacks early, understand attacker methods, and protect our systems
• What we collect: Logs, network traffic, system events, threat feeds, and more
• How we use it: To spot patterns, identify attacks, and improve defenses

Intelligence comes from many different places — just like a detective has many sources of information.

Network-based intelligence is like watching the roads to see who's coming and going.

• Network traffic logs: Recording every connection between computers
• NetFlow data: Summary information about network conversations
• Full packet capture: Recording EVERYTHING (like having a camera on every road)
• DNS logs: Records of which websites computers are visiting
• Proxy logs: Records of internet usage through a proxy server
• Firewall logs: Records of what traffic was allowed or blocked

Host-based intelligence is like having security cameras inside each building.

• System logs: Records of what happens on a computer (login, errors, etc.)
• Event logs: Windows and Linux event tracking
• Process monitoring: Which programs are running
• File integrity monitoring: Checking if important files have changed
• Registry monitoring (Windows): Watching for changes to system settings
• Antivirus logs: Records of malware detections
• Endpoint Detection and Response (EDR): Advanced monitoring that can detect suspicious behavior

SIEM is like the command center where all intelligence comes together.

• Collects data from all sources (network, hosts, security tools)
• Correlates events — connects related events to see the big picture
• Detects patterns — spots suspicious activity
• Generates alerts — tells security teams when something is wrong
• Provides dashboards — shows everything in one place
• Stores data — keeps records for investigations

Threat Intelligence Platforms collect information about attacks happening around the world.

• Public threat feeds: Free information about known attacks
• Commercial threat feeds: Paid intelligence from security companies
• ISACs (Information Sharing and Analysis Centers): Industry groups that share threat information
• Indicators of Compromise (IoCs): Specific signs of an attack (like a "fingerprint" of malware)
• Automated sharing: Computers automatically share threat information with each other
• STIX/TAXII: Standard formats for sharing threat intelligence

Logs are records of events that happen on a computer or network.

Think of them like a diary or journal that writes down everything that happens.

• Who: Which user or system did something
• What: What action was taken
• When: The date and time
• Where: Which computer or system
• Result: What happened (success, failure, error)

There are many different types of logs, just like there are different types of diaries.

• 🔐 Security logs: Login attempts, access to files, privilege changes
• 🖥️ System logs: Computer startup, errors, hardware problems
• 🌐 Application logs: What programs are doing (like a game logging your progress)
• 📡 Network logs: Who is connecting to your computer
• 🛡️ Antivirus logs: What threats were found and blocked
• 📧 Email logs: Who sent emails to whom
• 🔄 Audit logs: Special logs that track changes for security purposes

Reading logs manually is like reading millions of pages — impossible! So we use tools to help us.

SIEM (Security Information and Event Management) is like a super-powered log reader.

• Collects logs from many different sources
• Normalizes data — makes logs from different systems look the same
• Correlates events — connects related events across different logs
• Detects patterns — finds suspicious activity automatically
• Generates alerts — tells security teams when something is wrong
• Provides dashboards — shows everything in one place

Regular expressions (or "regex") are like a super-powered search for text.

• Find patterns: Search for specific patterns in logs
• Example: Find all IP addresses in a log
• Example: Find all failed login attempts
• Example: Find all emails in a log
• Very powerful: Can find almost any pattern you can imagine!

When you analyze logs, you're looking for suspicious patterns that might mean an attack.

• Multiple failed logins: Someone trying to guess a password (brute force attack)
• Login at strange times: Someone logging in at 3 AM when the office is closed
• Unusual data transfers: Someone moving large amounts of data at odd hours
• New user accounts: Someone creating accounts they shouldn't
• Changes to security settings: Turning off antivirus or firewalls
• Access to sensitive files: HR or finance files being opened by people who shouldn't

Active analysis means examining computers and networks while they're running.

It's like checking a patient's vital signs while they're alive, instead of after they've passed away.

• Asset analysis: Examining individual computers, servers, and devices
• Network analysis: Examining how devices talk to each other
• Why it's important: Find active attacks, understand what's happening right now
• What we look for: Suspicious processes, connections, files, and behaviors

Windows computers have built-in tools to help us investigate. Here are the most important ones:

Indicators of Compromise (IoCs) are clues that tell us an attack has happened.

They're like fingerprints left behind by the attacker.

• File hashes: Unique fingerprints of malicious files
• IP addresses: Addresses of attacker's computers
• Domain names: Websites used for command and control
• Registry keys: Changes made to Windows settings
• File paths: Where malware hides
• Network patterns: Unusual traffic patterns
• Email addresses: Used in phishing attacks

Malware analysis is like a doctor studying a disease to find a cure.

• Static analysis: Looking at the malware without running it (like reading a recipe before cooking)
• Dynamic analysis: Running the malware in a safe environment to see what it does (like watching the bad guy in action)
• Behavioral analysis: Watching what the malware does (what files it touches, what connections it makes)
• Code analysis: Reading the malware's programming code (like reading the criminal's plan)
• Sandboxing: Running malware in a isolated virtual machine (like a padded cell for viruses)

Network analysis is like watching traffic cameras to see who's coming and going.

• Wireshark: The most popular network analyzer (like a traffic camera for data)
• tcpdump: Command-line network capture tool
• NetFlow: Summary of network conversations
• What to look for: Unusual connections, data transfers, and patterns
• Port scanning: Attackers scanning for open "doors" (ports)
• Beaconing: Regular "check-ins" to attacker servers

Evidence collection is like collecting evidence at a crime scene — you have to be careful!

• Chain of custody: Documenting who handled the evidence and when
• Imaging: Making an exact copy of a hard drive (like taking a photo of the crime scene)
• Write-blockers: Tools that prevent changes to evidence
• Hashing: Creating a unique fingerprint of evidence to prove it hasn't changed
• Live forensics: Collecting evidence from a running computer
• Dead forensics: Collecting evidence from a turned-off computer

Active analysis means examining computers and networks while they're running.

It's like checking a patient's vital signs while they're alive, instead of after they've passed away.

• Asset analysis: Examining individual computers, servers, and devices
• Network analysis: Examining how devices talk to each other
• Why it's important: Find active attacks, understand what's happening right now
• What we look for: Suspicious processes, connections, files, and behaviors

Windows computers have built-in tools to help us investigate. Here are the most important ones:

Indicators of Compromise (IoCs) are clues that tell us an attack has happened.

They're like fingerprints left behind by the attacker.

• File hashes: Unique fingerprints of malicious files
• IP addresses: Addresses of attacker's computers
• Domain names: Websites used for command and control
• Registry keys: Changes made to Windows settings
• File paths: Where malware hides
• Network patterns: Unusual traffic patterns
• Email addresses: Used in phishing attacks

Malware analysis is like a doctor studying a disease to find a cure.

• Static analysis: Looking at the malware without running it (like reading a recipe before cooking)
• Dynamic analysis: Running the malware in a safe environment to see what it does (like watching the bad guy in action)
• Behavioral analysis: Watching what the malware does (what files it touches, what connections it makes)
• Code analysis: Reading the malware's programming code (like reading the criminal's plan)
• Sandboxing: Running malware in a isolated virtual machine (like a padded cell for viruses)

Network analysis is like watching traffic cameras to see who's coming and going.

• Wireshark: The most popular network analyzer (like a traffic camera for data)
• tcpdump: Command-line network capture tool
• NetFlow: Summary of network conversations
• What to look for: Unusual connections, data transfers, and patterns
• Port scanning: Attackers scanning for open "doors" (ports)
• Beaconing: Regular "check-ins" to attacker servers

Evidence collection is like collecting evidence at a crime scene — you have to be careful!

• Chain of custody: Documenting who handled the evidence and when
• Imaging: Making an exact copy of a hard drive (like taking a photo of the crime scene)
• Write-blockers: Tools that prevent changes to evidence
• Hashing: Creating a unique fingerprint of evidence to prove it hasn't changed
• Live forensics: Collecting evidence from a running computer
• Dead forensics: Collecting evidence from a turned-off computer

Incident Response is a step-by-step plan for handling cyber attacks.

It's like a fire drill — everyone knows what to do when something goes wrong.

• Detect: Find out an attack is happening
• Contain: Stop the attack from spreading
• Eradicate: Remove the attacker and their tools
• Recover: Restore systems to normal
• Learn: Figure out what happened and how to prevent it

The first step is finding out that an attack is happening.

• Alerts: SIEM, antivirus, firewalls, and intrusion detection systems
• Human reports: Employees noticing something strange
• Threat intelligence: Information about attacks happening elsewhere
• Log analysis: Finding suspicious patterns in logs
• Anomalies: Things that don't look right (like a login at 3 AM)

Containment is like putting a wall around the fire to stop it from spreading.

• Short-term containment: Immediate actions to stop the attack (like disconnecting a hacked computer from the network)
• Long-term containment: Temporary fixes while you plan permanent solutions
• Network segmentation: Isolating parts of the network
• Blocking: Blocking attacker IP addresses or domains
• Account suspension: Disabling compromised user accounts

Eradication is like putting out the fire completely and cleaning up the ashes.

• Removing malware: Using antivirus or special removal tools
• Deleting attacker files: Removing malicious files and programs
• Removing backdoors: Closing secret entrances attackers created
• Patching vulnerabilities: Fixing the holes attackers used to get in
• Reinstalling systems: Sometimes you have to completely rebuild a computer

Recovery is about getting things back to normal after the attack.

• Restoring data: Using backups to restore lost files
• Rebuilding systems: Reinstalling operating systems and applications
• Testing: Making sure everything works before going back to normal
• Monitoring: Watching closely to make sure the attack doesn't come back
• Communication: Telling employees, customers, and regulators what happened

Lessons learned is the most important step — figuring out what went wrong and how to prevent it.

• Root cause analysis: What was the real reason the attack happened?
• What went well: What did we do right during the response?
• What went wrong: What could we have done better?
• Improvements: What changes do we need to make?
• Updating plans: Updating the incident response plan with new knowledge